Audit trail

[wossname]

If a command to alter the file Creation date of a file on the network is issued, is it possible to find out who sent the command and when?

How difficult is it to find out and what tools would I need?